Taking Inventory 



The first and most important step in determining your risk level is to conduct an extensive 
technology item inventory. In conducting your technology item inventory, you will determine what 
technology items you use in your organization, which ones are likely to be affected by the Year 
2000 Problem, and which items would do the most damage if they were to fail in the year 2000. 

You must identify every technology item in your organization, including information about the 
manufacturer and a complete description of the operating platform used by the item. 

What is a Technology Item? 

For the purpose of your inventory, a technology item is any circuit-based application that utilizes a 
date during its operation. If you do not know whether an item utilizes a date, it's better to include it 
than to find out too late that you should have. 

Some of these items will be obvious to you: your computers, the computers' operating system(s), 
the applications that run on your computers, your printers, your phone system, and so on. Other 
items will not be as obvious, such as your networking and communications infrastructure, 
photocopiers, fax machines, air-conditioning system, sprinkler system, company vault, and even the 
elevator. 

Conducting the Inventory 

Use the Inventory Worksheet included in this chapter to conduct your Technology Item Inventory. 
Make as many copies of it as you need, but be sure to save the original in case you need more later. 
Fill out one worksheet for each technology item. 
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Important: Whenever possible, fill out all of the information on the worksheet for each technology 
item. This is especially important when you inventory the software applications used in your 
organization because other factors, such as hardware and operating systems, affect software's 
functionality. However, there may be times when this is not possible. For example, if you inventory 
your photocopier, you'll probably only need the name, model number, and vendor information. 

If you don't know all of the information, the manufacturer should be able to provide it for you or 
tell you how to obtain it. 

Be as thorough as possible when conducting your BY2000 Inventory. If you have a current 
inventory report of the items in your office, this might be a good place to start. 

In larger companies, it may be necessary to assemble an inventory team to get this job done (one 
person from each department, for example). Only you can know the best way to go about 
conducting the inventory in your organization. However, it is imperative that everyone involved in 
the inventory process have a full understanding of the purpose of the inventory and the necessity of 
being thorough. 

Using the Inventory Worksheet 

Following are descriptions of the information to include on the inventory worksheet. 
Product Name 

Fill in the name of the technology item. 
Version 

In computer software, this refers to the product's version number. You may find the version number 
on the disks or in the documentation that came with the software. 

It is very important to identify the version number, because particular versions may be year 2000 
compliant, while other versions of the same product may not be. 

Description 

Describe in detail how and to what extent the technology item is used, as well as any links the item 
may have to other technology items. 

The description requires a thorough understanding of the technology item. It is very important, 
because it is the criteria you will use to determine the item's System Significance. For more 
information on System Significance, refer to the section "Assigning System Significance" at the end 
of this chapter. 

Hardware and Processor 

Describe the hardware, including the model number, size of computer memory, processor type and 
speed. 
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If the technology item is a software application, describe the hardware and processor (or processors) 
on which the application is being used. 

Firmware 

Describe any firmware utilized by the technology item. 

Firmware is a set of electronic system instructions that are hard-coded onto a chip in a computer 
processor. In the context of a computer, some people use different terminology to describe 
firmware, such as SETUP, BIOS, CMOS, and so on. However, firmware is not limited to 
computers. Other technology items may also contain or utilize firmware. 

Firmware literally exists and functions in-between hardware and software (as a chip, it is hardware, 
as a set of instructions, it is software). On a computer, firmware operates from the moment you 
switch on your computer — even before the operating system kicks in. It is the firmware that keeps 
track of the date and time, tells your computer how many drives are attached to the computer, their 
size, the processor speed, the monitor configuration, and much more. 

Firmware can be important to consider, especially for the technology items most critical to your 
company's operation. If the firmware in a critical component of your organization can not handle 
the year 2000 date change, that item could be inoperable on January 1. 

In the case of computer software, it is important to identify firmware because the manufacturer may 
indicate the software is year 2000 compliant, but may not have tested it with the firmware you are 
using. 

Firmware can be difficult to identify. Unfortunately, you can't always rely on the vendor of a 
technology item to give you firmware information, because they do not necessarily know the 
changes that have been made to the item since its purchase. Keep in mind that a technology item 
may have more than one firmware component, especially if special cards or other peripheral devices 
have been added to it. 

In computers, the firmware name and version number are sometimes displayed as the computer 
boots up (before the operating system, such as Windows®, starts working). Other computers display 
a message as they boot up, such as Press <DEL> key if you want to run SETUP. Press the specified 
key when this message appears to enter the SETUP area, where you can find the firmware 
information for the computer. 

If you do not feel you are qualified to identify the firmware used in your organization, it is 
imperative that you find someone who is qualified. 

Very Important: You may decide that you don't need to identify the firmware for every technology 
item. But remember, firmware is a potential point of failure. 

Any item utilizing uncertified firmware has a potential for failure in the year 2000. 
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Operating System 

If the technology item is a software application, describe the operating system(s), including version 
numbers, on which the item is being used. 

An operating system is software that coordinates interaction between a physical hardware device, 
such as your computer, and application programs. Examples of operating systems include DOS, 
Windows 3.1, and Windows 95, for personal computers, OS/400® for IBM® AS/400® midrange 
computers, and MVS® for IBM mainframe computers. 

It is important to identify the operating system for each technology item, because the manufacturer 
may claim the Year 2000 Problem has been corrected for the technology item, but may not have 
tested it with the operating system you are using. 

Vendor Information 

The vendor, or manufacturer, is simply the company who makes the technology item. In some cases 
the vendor may exist within your own organization. For example, your Information Services 
department might be the vendor for one of your technology items. Record the vendor's name, 
address, phone and fax numbers, as well as the name of a contact person at the company. This 
information is important in order to maintain correspondence with the vendor while trying to 
determine if the Year 2000 Problem has been corrected for the technology item. 

System Significance 

For your convenience, check boxes are located at the bottom of the inventory worksheet for you to 
specify a system significance for the technology item. System significance is discussed in the 
section, "Assigning System Significance." 

A technology item's system significance is an important factor in determining your organization's 
risk. Assigning system significance to your technology items is a process that will take some 
thought. Most likely, you won't do this at the same time as you conduct the technology item 
inventory. 
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Product Name: 



Version: 



Description: 



Hardware: 



Firmware: 



Operating System: 



Vendor: 



Contact Name: 



Phone: 



Address: 



System 
Significance: 



Application Software Application Interface 

Processor Assisted Device (check one) 



Fax: 



Mission Critical Q Mission Necessary 

Mission Desirable Mission Unrelated 
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The Inventory Process 

Following these steps will make conducting your inventory easier and will help ensure that the 
BY2000 Risk Rating accurately reflects your overall risk. 

1. First, inventory the computer applications used in your organization. When you inventory your 
computer applications, it is especially important to record the following information: 

• Product name and version number 

• Operating system and version number 

• Firmware and version number 

• Hardware and model number 

Note: If the technology item is used with more than one operating system, firmware, or 
hardware device, - or with more than one version of operating system, firmware, or hardware - 
fill out separate inventory worksheets for the item reflecting each of these differences. 

2. Second, inventory the operating systems in your organization that are not running computer 
applications or do not have computer applications that can be identified separately. (It is 
possible that you do not have any such items in your organization.) If an operating system has 
already been included on the inventory worksheet for a computer application, you do not need 
to inventory it as a separate technology item. When you inventory an operating system, it is 
especially important to include the following information: 

• Product Name and version number (in this case, the product is the operating system) 

• Firmware and version number 

• Hardware and model number 

3. Third, inventory the firmware in your organization that has no identifiable operating system. (It 
is possible that you do not have any such items in your organization.) If the firmware has 
already been included on the inventory worksheet for a previously inventoried item, you do not 
need to inventory it as a separate technology item. When you inventory firmware, it is 
especially important to include the following information: 

• Product name and version number (in this case, the product is the firmware) 

• Hardware and model number 

4. Finally, inventory the hardware that does not have any firmware, operating system, or computer 
applications that can be identified separately. If the hardware has already been included on the 
inventory worksheet for a previously inventoried item, you do not need to inventory it as a 
separate technology item. When you inventory hardware, make sure you identify the following 
information: 

• Product name and model number (in this case, the product is the hardware itself) 
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Assigning System Significance 

An important aspect of the B Y2000 Risk Assessment System is the identification of the System 
Significance of each item in your Technology Item Inventory. A technology item's significance to 
your organization's business greatly affects the potential risk that item poses to your organization 
and influences the decisions you make and actions you take to protect your business from the Year 
2000 Problem. 

After you've conducted your inventory, go through the inventory worksheets you filled out and 
assign a system significance to each technology item. 

Each technology item in your inventory must be assigned to one of four system significance 
categories: 

Mission Critical 

A technology item is Mission Critical if the absence of that item would cause significant harm to 
your organization. Problems with such a system might cause financial liability, immediate loss of 
revenue, customer service problems leading to loss of revenue, harm to your reputation, unwanted 
publicity, and so on. 

Mission Necessary 

A technology item that is Mission Necessary could cause significant disruption of business and 
reductions in productivity or customer service if it were to fail. 

Mission Desirable 

A technology item that is Mission Desirable is useful in assisting your organization in 
accomplishing its objectives. However, in the absence of such an item, your organization should be 
able to function with little noticeable disruption (perhaps by using alternative applications). 

Mission Unrelated 

A technology item is Mission Unrelated if it does not fit into any of the other three categories. This 
may be an item that is in use, even though better alternatives are available within your organization. 
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